xtremerat | 404095c2d1b2faff39969b952eac822d1a4dc61b4c0d2e4c6db2a29870646cb0

General

Target

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
Size

341KB
MD5

e3da07473d8361f6ee34113987b5cae7
SHA1

1eb02923a8327d9754752d8631b14c8e364ce7b7
SHA256

404095c2d1b2faff39969b952eac822d1a4dc61b4c0d2e4c6db2a29870646cb0
SHA512

c3c48a10913aa744439d908d5337b8328de6595ca63719825fe84e56d90b86a5531554eb623616dce41ae86eebe08aa1425888f7ebd200bd206e12e1973ff53a
SSDEEP

1536:l0LCEWYTuK652xCAq3TNbbYKxXWgHeHGqLGjNBsyRxpPfw1npfBHFg2l0AkSo:+LC+u+9mq+Th9gZlg2aHZ

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Detect XtremeRAT payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2984-12-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2984-11-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2984-13-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2984-15-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2984-14-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat
behavioral1/memory/2984-18-0x0000000000C80000-0x0000000000C93000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Suspicious use of SetThreadContext 2 IoCs

Processes:

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

description	pid	process	target process
PID 2040 set thread context of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 set thread context of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2040 e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
2⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
2⤵
PID:2984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1240-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1240-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1240-5-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1240-7-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1240-8-0x0000000000AF0000-0x0000000000AF0000-memory.dmp

Download
memory/2040-20-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2040-1-0x0000000073FE0000-0x00000000746CE000-memory.dmp

Filesize
6.9MB

Download
memory/2040-0-0x0000000000AF0000-0x0000000000B4C000-memory.dmp

Filesize
368KB

Download
memory/2984-9-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2984-12-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2984-11-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2984-13-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2984-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-15-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2984-14-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2984-18-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download
memory/2984-10-0x0000000000C80000-0x0000000000C93000-memory.dmp

Filesize
76KB

Download

description	pid	process	target process
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 1240	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe
PID 2040 wrote to memory of 2984	2040	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe	e3da07473d8361f6ee34113987b5cae7_JaffaCakes118.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads